It would be wonderful if it had been a simple race between light and neutrinos, and the neutrinos arriving first. Sadly, it is not as simple as this.

In reality, "trains" of millions and millions of neutrinos are generated in Switzerland, from where they travel straight through the earth, to be detected in an experiment in Italy. Over three years of measurements, 16111 neutrinos have been recorded and timed.

Each train of neutrinos is 10500 nanoseconds long, and the average neutrino is measured to appear 60 nanoseconds earlier than expected. The problem is that of the millions of neutrinos sent, only a few get detected.

So when the arrival of a neutrino is measured, it is not certain if it is one from the beginning of the 10500 nanosecond long train, or one at the end.

If the train of neutrinos were exactly uniform, you could just take the average travel time, and be done with it. In the end the length of the train would average out. The problem is that the density of neutrinos being sent is absolutely not uniform.

Through crafty statistics however, and by measuring the precise density shape of the train in Switzerland, it is however possible to still generate an average travel time. And this is the number that is being reported, between 50 and 70 nanoseconds too fast (more or less).

This corresponds to around 180 18 meters at the speed of light. The distance to between where the beam starts and where it is measured is known to 20 centimeters precise, so that is not a problem. It also appears that the very best timekeeping people in the whole world have been involved in making sure the clocks are running correctly.

It is an impressive effort. It would have been a lot easier if we could just organize a race between a neutrino and a photon. The result now reported is statistical in nature, but the statistics are impressive. It should however be realized that a lot of calculations are needed to get the 60ns number, and a mistake could hide anywhere.

The result can be compared to trying to measure if a (real) train runs on schedule by timing when people walk out of the train station. If you keep that up long enough, you will be able to get results - but a lot of things could mess with your measurements!

On a final note, it might well turn out that neutrinos do not travel faster than light, but that there is another reason why we are getting these results. That might in itself be almost as interesting!

Saturday, July 23, 2011

While singing my lovely son to sleep just now, an idea popped up in my head which I'm hoping is not yet patented. If it isn't, this post should kill any chances of that ever happening. Here goes.

Bluetooth and Wifi on smartphones both draw power, even when there is no actual Wifi or Bluetooth connection active - the mere act of listening for a potential pairing costs energy.

However, when I'm on my home Wifi, I am never on Bluetooth. When I'm connected to Bluetooth, I'm never eager for a wireless connection.

Thus, wouldn't it be nice if there was a piece of software that shutdown the Bluetooth listener if connected to Wifi? And if that Wifi goes out of range, turn off the Bluetooth again. If that leads to a connection, shut down the Wifi listener.

I'm pretty sure that for many use cases (people with wifi at home and at the office, and bluetooth handsfree in the car), this would save like.. joules per day! ;-)

This post was of course inspired by my phone shutting down while I was reading the web while singing my son to sleep.

So - feel free to make this appear on the Android market or the appstore. And who knows, it might be there already.

Released on the 22nd of July 2011
RC1 released on the 4th of April 2011
RC2 released on the 19th of April 2011
RC3 released on the 19th of July 2011

Version 3.0 of the PowerDNS Authoritative Server brings a number of important features, as well as over two years of accumulated bug fixing.
The largest news in 3.0 is of course the advent of DNSSEC. Not only does PowerDNS now (finally) support DNSSEC, we think that our support of this important protocol is among the easiest to use available. In addition, all important algorithms are supported.
Complete detail can be found in Chapter 12, Serving authoritative DNSSEC data. The goal of 'PowerDNSSEC' is to allow existing PowerDNS installations to start serving DNSSEC with as little hassle as possible, while maintaining performance and achieving high levels of security.
Tutorials and examples of how to use DNSSEC in PowerDNS can be found linked from http://powerdnssec.org.
PowerDNS Authoritative Server 3.0 development has been made possible by the financial and moral support of:

Upgrade the experimental native Lua backend to the latest version from Frederik Danerklint (commit 2240) and include this backend in the .deb packages (commit 2242)

Remove IPv6 dependency, it was only possible to run master/slave operations on a server with at least one IPv6 address. Some very old virtualized setups turned out to have no IPv6 at all. Fix incommit 2246.

Changes between RC2 and RC3:

PowerDNS Authoritative Server could not be configured to use an IPv6 based resolving backend. Solved in commit 2191.

PowerDNS can fill out default fields for SOA records, but neglected to do so if the SOA record was matched by an incoming ANY question. Spotted by Marc Laros & others. Fixes ticket 357, code incommit 2206.

By popular demand, a tweak which makes an overloaded database no longer restart PowerDNS but to drop queries until the database is available again. Code in commit 2217, lightly tested. Enable by setting 'overload-queue-lengh=100' (for example).

By suggestion of Miek Gieben of SIDN, add SOA-EDIT mode 'EPOCH' which sets the SOA serial number to the 'UNIX time'. Implemented in commit 2218.

Added some US export control & ECCN to documentation, needed because of DNSSEC content. Update in commit 2219.

Fix up various spelling mistakes and badly formatted messages (commit 2220 and commit 2221) by Maik Zumstrull and 'anonymous'.

After a lot of thought, we now handle CNAMEs to names outside our knowledge ('bailiwick') exactly as in BIND 9.8.0, even though our way was standards compliant too. It confused things. Update incommit 2222 and commit 2224.

Silence SIGCHLD warning from Perl when used to power 'pipe' backends (commit 2232).

Add experimental support, off by default, for draft-edns-subnet. See commit 2233 and commit 2239 for details how to use this feature.

PostgreSQL and LDAP backends can now deal with a restart of their respective servers. Many thanks to Peter van Dijk for debugging and Nikolaos Milas for supplying a reproduction path of the problem (& much nagging). Fixes in commit 2233 and commit 2235.

Jan-Piet Mens discovered that records inserted by Lua on zone retrieval did not get correct 'ordername' and 'auth' fields for DNSSEC. Fixed in commit 2174.

Silenced various relevant and less relevant compilation warnings (commit 2175). Thanks to Serge Belyshev for pointing out the error in our ways.

Steve Bauer discovered we would cache empty recursive answers in some cases. Addressed in commit 2176.

James Cloos reported that 'pdnssec check-zone' tripped over SRV records. Fixed this, and added check-zone to the regression tests. Code in commit 2177.

DNSSEC regression tests were added in commits 2178, 2179, 2182, 2186 We test against the fine tools from NLNetLabs.

Stef Van Dessel suggested we made our RPMs state explicitly that they need glibc 2.4 on Linux. Code in commit 2184.

John Leach discovered our MySQL based backends would wait for ages on a failing MySQL server. The patch merged in commit 2189 reduces the timeout significantly, which is especially useful with haproxy and mysqlproxy.

commit 2190 fixes a crash reported by Marc Laros when using a non-DNSSEC capable backend. Should also improve non-DNSSEC performance.

Changes between RC1 and RC2:

Zone2sql sent out the wrong 'COMMIT' statement in sqlite mode. In addition, in this mode, zone2sql would not emit statements to update the domains table unless the 'slave' setting was chosen. Code in commit 2167.

We dropped the Authoritative Answer flag on an out-of-bailiwick CNAME referral, which was unneccessary. Code in commit 2170.

Kees Monshouwer discovered that we failed to detect the location of PostgreSQL on RHEL/CentOS. Fix in commit 2144. In addition, commit 2162 eases detection of MySQL on RHEL/CentOS 64 bits systems.

Marc Laros re-reported an old bug in the internally used 'pdns' backend where details of the SOA record were not filled out correctly. Resolved in commit 2145.

Jan-Piet Mens helped debug an issue where some servers were "almost always" unable to transfer a TSIG signed zone correctly. Turns out that the TSIG signing code used an internal timestamp and not the remote timestamp. Because of good NTP synchronization this quite often was not a problem. Fix in commit 2159.

Thor Spruyt of Telenet discovered that the PowerDNS code would try to emit DNS answers over TCP of over 65535 bytes long, which failed. We now truncate such answers properly. Code in commit 2150.

The Slave engine now reuses an existing database connection, removing the need to create a new database connection every minute (and worse, log about it). Code in commit 2153.

Fix a potential Year 2106 bug in the TSIG signing code. Because we care (commit 2156).

Added experimental support for the 'DANE' TLSA record which is used to authenticate SSL certificates via DNSSEC. commit 2161.

Added experimental support for the MongoDB 'NoSQL' backend, contributed by fredrik danerklint in commit 2162.

On to the release notes. Next to DNSSEC, other major new features include:

PowerDNS can now slave zones over IPv6 and notify IPv6 remotes of updates. Already. Code in commit 2009 and beyond.

Lua based incoming zone editing, allowing masters or signing slaves to add information to the zone they will (re-)serve. Implemented in commit 2065. To enable, use LUA-AXFR-SCRIPT zone metadata setting.

Native Oracle backend with full DNSSEC support. Contributed by Maik Zumstrull, then at the Steinbuch Centre for Computing at the Karlsruhe Institute of Technology.

"Also-notify" support, implemented by Aki Tuomi in commit 1400. Support for Generic SQL backends and for the BIND backend. Further code in commit 1360.

Support for binding to thousands of IP addresses, code in commit 1443.

PowerDNS would refuse to serve domain names with spaces in them, or otherwise non-printable characters. Addressed in commit 2081.

PowerDNS can now serve escaped labels, as described by RFC 4343. Data should be present in backends in that escaped form. Code in commit 2089.

In some cases, we would include duplicate CNAMEs. In addition, we would hand out a full root-referral when not configured to in some cases (ticket ticket 223). Discovered by Andreas Jakum, fixed incommit 1344.

SOA queries for the name of a delegation point were not referred. Fix in commit 1466, closing ticket 224. In addition, queries for AAAA for a CNAMEd record pointing to a name with no AAAA would deliver a direct SOA, without the CNAME in between. Fix in commit 1542, commit 1607. Also, wildcard CNAMEs pointing to a record without the type requested suffered from the same issue, fix incommit 1543.

On processing an incoming AXFR, once an MX or SRV record had been seen, all future fields got a 'priority' entry as well. This had no operational impact, but looked messy. Fixed in commit 1437.

Fixed a bug that could cause crashes on launching thousands of backend connections. Never observed to occur, but who knows. Fix in commit 1792.

Under some circumstances, large answers could be truncated in mid-record. While technically legal, this upset a number of resolver implementations (including the PowerDNS Recursor!). Fixed incommit 1830, re-closes ticket 200.

Long TXT records are now split into 255-byte components automatically. Implemented in commit 1340, reported by Darren Gamble in ticket 188.

When receiving large numbers of notifications, PowerDNS would check these synchronously, leading to a slowdown for other services. Fixed in commit 2058, problem diagnosed by Richard Poole of Heart Internet.

Monday, June 13, 2011

The venerable GNU C Library just saw the release of 2.14. Within the release notes there is a list of bug numbers that are addressed by this release. Some of these are highlighted in the release notes, but most aren't.

I did some scripting and here is a lightly edited list of things fixed. I added a link to bug 10149, you can guess the URL for the rest. I bolded things that might actually hit my programs (and who knows, yours):

(potentially) security related:

Bug 10149 - stack guard should lead with zero byte to gain protections

Tuesday, April 5, 2011

I'm very proud to announce the first Release Candidate for PowerDNS Authoritative Server 3.0, now with full support for DNSSEC, TSIG, IPv6 master/slave, per-zone metadata and Lua zone editing. The DNSSEC support is 'fully automatic' - if everything goes well, all that is required is to set 'pdnssec secure-zone powerdns.com' and your zone is secured.

Read on for more information! To download, head to http://powerdnssec.org/downloads

We are not 100% convinced all corner cases of NSEC3/NXDOMAIN give correct responses. Common cases function well

DNSSEC has only been benchmarked up to 2000 queries/second but not beyond

A lot more database connections are made and released

Note

RC1 released on the 4th of April 2011

Version 3.0 of the PowerDNS Authoritative Server brings a number of important features, as well as over two years of accumulated bug fixing.
The largest news in 3.0 is of course the advent of DNSSEC. Not only does PowerDNS now (finally) support DNSSEC, we think that our support of this important protocol is among the easiest to use available. In addition, all important algorithms are supported.
Complete detail can be found in Chapter 12, Serving authoritative DNSSEC data. The goal of 'PowerDNSSEC' is to allow existing PowerDNS installations to start serving DNSSEC with as little hassle as possible, while maintaining performance and achieving high levels of security.
Tutorials and examples of how to use DNSSEC in PowerDNS can be found linked from http://powerdnssec.org.
This release has received exceptional levels of community support, and we'd like to thank the following people in addition to those mentioned explicitly below: Peter Koch (DENIC), Olaf Kolkman (NLNetLabs), Wouter Wijngaards (NLNetLabs), Marco Davids (SIDN), Markus Travaille (SIDN), Leen Besselink, Antoin Verschuren (SIDN), Olafur Gudmundsson (IETF), Dan Kaminsky (Recursion Ventures), Roy Arends (Nominet), Miek Gieben (SIDN), Stephane Bortzmeyer (AFNIC), Michael Braunoeder (nic.at), Peter van Dijk, Maik Zumstrull, Jose Arthur Benetasso Villanova (Locaweb), Stefan Schmidt, Roland van Rijswijk (Surfnet), Paul Bakker (Brainspark/Fox-IT), Mathew Hennessy, Johannes Kuehrer (Austrian World4You GmbH), Marc van de Geijn (bHosted.nl), Stefan Arentz and Martin van Hensbergen (Fox-IT), Christof Meerwald, Detlef Peeters, Jack Lloyd, Frank Altpeter, frederik danerklint, Vasiliy G Tolstov, Brielle Bruns, Evan Hunt, Ralf van der Enden.
On to the release notes. Next to DNSSEC, other major new features include:

PowerDNS can now slave zones over IPv6 and notify IPv6 remotes of updates. Already. Code in commit 2009 and beyond.

Lua based incoming zone editing, allowing masters or signing slaves to add information to the zone they will (re-)serve. Implemented in commit 2065. To enable, use LUA-AXFR-SCRIPT zone metadata setting.

Native Oracle backend with full DNSSEC support. Contributed by Maik Zumstrull, then at the Steinbuch Centre for Computing at the Karlsruhe Institute of Technology.

"Also-notify" support, implemented by Aki Tuomi in commit 1400. Support for Generic SQL backends and for the BIND backend. Further code in commit 1360.

Support for binding to thousands of IP addresses, code in commit 1443.

PowerDNS would refuse to serve domain names with spaces in them, or otherwise non-printable characters. Addressed in commit 2081.

PowerDNS can now serve escaped labels, as described by RF4343. Data should be present in backends in that escaped form. Code in commit 2089.

In some cases, we would include duplicate CNAMEs. In addition, we would hand out a full root-referral when not configured to in some cases (ticket ticket 223). Discovered by Andreas Jakum, fixed in commit 1344.

SOA queries for the name of a delegation point were not referred. Fix in commit 1466, closing ticket 224. In addition, queries for AAAA for a CNAMEd record pointing to a name with no AAAA would deliver a direct SOA, without the CNAME in between. Fix in commit 1542, commit 1607. Also, wildcard CNAMEs pointing to a record without the type requested suffered from the same issue, fix in commit 1543.

On processing an incoming AXFR, once an MX or SRV record had been seen, all future fields got a 'priority' entry as well. This had no operational impact, but looked messy. Fixed in commit 1437.

Fixed a bug that could cause crashes on launching thousands of backend connections. Never observed to occur, but who knows. Fix in commit 1792.

Under some circumstances, large answers could be truncated in mid-record. While technically legal, this upset a number of resolver implementations (including the PowerDNS Recursor!). Fixed in commit 1830, re-closes ticket 200.

Long TXT records are now split into 255-byte components automatically. Implemented in commit 1340, reported by Darren Gamble in ticket 188.

When receiving large numbers of notifications, PowerDNS would check these synchronously, leading to a slowdown for other services. Fixed in commit 2058, problem diagnosed by Richard Poole of Heart Internet.

Tuesday, January 11, 2011

With the help of many of you, we've now brought 'PowerDNSSEC' to the point where it is in light production. Several of our important domains have already been migrated to the PowerDNS Authoritative Server 3.0 prereleases. Several PowerDNS usershave done the same with their domains (please let us know!).

In brief, PowerDNSSEC will allow you to continue operating as normal in many cases, with only slight changes to your installation. There is no need to run signing tools, nor is there a need to rotate keys or run scripts.

Particularly, if you run with Generic MySQL, Generic PostgreSQL or Generic SQLite3, you should have an easy time. A small schema update is required, plus an invocation of 'pdnssec secure-zone domain-name ; pdnssec rectify-zone domain-name' per domain you want to secure. And that should be
it.